Inconsistent Request Path Normalization in Armeria by LINE
CVE-2026-121823

8.7HIGH

Key Information:

Vendor

Ly Corporation

Status
Armeria
Vendor
CVE Published:
6 November 2026

What is CVE-2026-121823?

A newly discovered vulnerability in earlier versions of Armeria exposes protected resources to unauthenticated attackers by allowing them to bypass path-based access controls through inconsistent request path normalization. This flaw could lead to unauthorized access and potential data exposure, making it critical for users of Armeria to upgrade to at least version 1.43.0 to mitigate the risk.

Affected Version(s)

Armeria 1.43.0

References

https://line.github.io/security-advisory-blog/CVE-2026-12...
https://github.com/line/armeria/security/advisories/GHSA-...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.